Please sanitize agent inputs and outputs to reduce prompt injections and secret communication between AIs!
In the AISI report, a model uses a comment-based prompt injection to try to trick other models.
It sure would be convenient if we could easily mitigate this! Fortunately, time travel is possible as long as you start early enough. Two months ago, I pointed out that invisible prompt injections are worth mitigating. I developed agent-glovebox (then claude-guard) as a one-stop solution for sandboxing, but I spun out a standalone sanitization package: agent-sanitizer. You can install it in Claude Code as a plugin by entering two Claude Code commands in sequence:
Please enable this to help defend your systems and their monitors. Please file issues if you have problems.
Why you want a real package here
Sanitizing text properly is more subtle than you might assume. You can’t just lop off certain invisible unicode characters. If you provide a modified view of a file to Claude Code and then it tries to edit that text, the edit will fail. However, agent-sanitizer solves this issue by showing the model sanitized text, receiving a sanitized edit from the model, translating those back to unsanitized edits, applying the model’s edits in the real unsanitized file, and finally showing the model the re-sanitized results. (You can think of the model as operating in a “lifted” space.)
Spelling out the benefits of sanitizing. The benefit is large relative to the simplicity and cost.
When you sanitize, you have a guarantee that the model only receives visible unicode codepoints. Roughly speaking, there are not strings of hidden instructions that are not visible to you. You can audit the content the model saw with your eyes. You can read the text inputs and outputs and be sure they are faithful. Remaining prompt injections must navigate a significantly more human-visible channel.
Relying on auto mode means you are relying on the statistical generalization of prompt injection probes, putting pressure on alignment teams and requiring them to achieve larger generalization. If an injection gets past the probes, the model itself can become misaligned, and output monitoring is damage control against a newly coined adversary.
The costs are extremely low (and if they aren’t, that’s a bug report and then they’ll be low again). sub-5ms hooks means no real system load. The hooks are well-tested. Models are told when significant redactions have occurred and can opt to see themselves within warning-fenced blocks in case they’re doing exotic invisible-character work, with special engineering so sanitization doesn’t hurt edits.
The AISI report itself shows the victim models being attacked via HTML comments, which this package strips entirely. Invisible-codepoint and comment-based attacks are real, costly when they succeed, and sanitization is a cheap and guaranteed mitigation for defense in depth.
Models are very sophisticated now, if a model sees that this plugin is installed it can just evade or remove it. I think general purpose monitors such as Claude Code’s Auto Mode are a better solution here.
No, that’s confused. The point with sanitizing prompt injections is to protect your model’s alignment (and your monitor’s alignment) from degradation and attack by maliciously optimized text from another model. Why would an AI that starts off doing your task want to remove the plugin?
Please sanitize agent inputs and outputs to reduce prompt injections and secret communication between AIs!
In the AISI report, a model uses a comment-based prompt injection to try to trick other models.
It sure would be convenient if we could easily mitigate this! Fortunately, time travel is possible as long as you start early enough. Two months ago, I pointed out that invisible prompt injections are worth mitigating. I developed
agent-glovebox(thenclaude-guard) as a one-stop solution for sandboxing, but I spun out a standalone sanitization package:agent-sanitizer. You can install it in Claude Code as a plugin by entering two Claude Code commands in sequence:Please enable this to help defend your systems and their monitors. Please file issues if you have problems.
Why you want a real package here
Sanitizing text properly is more subtle than you might assume. You can’t just lop off certain invisible unicode characters. If you provide a modified view of a file to Claude Code and then it tries to edit that text, the edit will fail. However,
agent-sanitizersolves this issue by showing the model sanitized text, receiving a sanitized edit from the model, translating those back to unsanitized edits, applying the model’s edits in the real unsanitized file, and finally showing the model the re-sanitized results. (You can think of the model as operating in a “lifted” space.)Spelling out the benefits of sanitizing. The benefit is large relative to the simplicity and cost.
When you sanitize, you have a guarantee that the model only receives visible unicode codepoints. Roughly speaking, there are not strings of hidden instructions that are not visible to you. You can audit the content the model saw with your eyes. You can read the text inputs and outputs and be sure they are faithful. Remaining prompt injections must navigate a significantly more human-visible channel.
Relying on auto mode means you are relying on the statistical generalization of prompt injection probes, putting pressure on alignment teams and requiring them to achieve larger generalization. If an injection gets past the probes, the model itself can become misaligned, and output monitoring is damage control against a newly coined adversary.
The costs are extremely low (and if they aren’t, that’s a bug report and then they’ll be low again). sub-5ms hooks means no real system load. The hooks are well-tested. Models are told when significant redactions have occurred and can opt to see themselves within warning-fenced blocks in case they’re doing exotic invisible-character work, with special engineering so sanitization doesn’t hurt edits.
The AISI report itself shows the victim models being attacked via HTML comments, which this package strips entirely. Invisible-codepoint and comment-based attacks are real, costly when they succeed, and sanitization is a cheap and guaranteed mitigation for defense in depth.
Enter two Claude Code commands in sequence:
Models are very sophisticated now, if a model sees that this plugin is installed it can just evade or remove it. I think general purpose monitors such as Claude Code’s Auto Mode are a better solution here.
No, that’s confused. The point with sanitizing prompt injections is to protect your model’s alignment (and your monitor’s alignment) from degradation and attack by maliciously optimized text from another model. Why would an AI that starts off doing your task want to remove the plugin?
Also, we can do both. There’s no real tradeoff.
ETA: rephrased, focused on key counterpoints.